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We show that the security proof of the Bennett 1992 protocol over loss-free channel in (K. Tamaki, 
M. Koashi, and N. Imoto, Phys. Rev. Lett. 90, 167904 (2003)) can be adapted to accommodate 
loss. We assumed that Bob's detectors discriminate between single photon states on one hand and 
vacuum state or multi-photon states on the other hand. 
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I. INTRODUCTION 

Quantum key distribution (QKD) is one of the most 
interesting topics in quantum information processing, 
which allows the sender (Alice) and the receiver (Bob) 
to share a secret key with negligibly leakage of informa- 
tion to an eavesdropper (Eve). This task is accomplished 
by making use of the properties of quantum mechan- 
ics, such as no-cloning theorem indistinguishability 
of nonorthogonal quantum states, entanglement, and so 
on 0]. The B92 protocol [3, where only two nonorthog- 
onal states are used, is thought to be secure due to the 
fact that Eve cannot clone and distinguish the states de- 
terministically. 

Although the qualitative reason of the security is sim- 
ple, it is quite hard to show the quantitative security 
against so-called coherent attack, which is the most gen- 
eral attack allowed by quantum mechanics. In 0,1^, the 
security of the BB84 protocol '3| is proven by showing 
the relationship between QKD and other important pro- 
tocols in quantum information, such as the entanglement 
distillation protocol (EDP) ^ and the Calderbank-Shor- 
Steane (CSS) quantum error correcting codes Q- Re- 
cently in 0, the unconditional security of the B92 pro- 
tocol has been proved by relating the B92 protocol to 
an entanglement distillation protocol (EDP) Q initiated 
by local filtering TqI. The assumptions of the proof are 
that Alice and Bob's devises are perfect and the quantum 
channel is loss-free. To study the unconditional security 
of B92 protocol over a lossy and noisy channel is inter- 
esting from the point of view of the quantum information 
theory, since the channel loss directly affects the security 
of the B92 protocol. The proof based on the equivalence 
between the security and EDPs gives us an idea how to 
distill the EPR state from states that arise from the lossy 
and noisy channel. 

In this paper, we study the unconditional security of 
the B92 protocol. We assume that Alice has a perfect 
single photon source, Bob's polarization measurement is 
perfect and he has a perfect single photon counter that 



discriminates between single photon states on one hand 
and vacuum state or multi-photon states on the other 
hand. Under these assumptions, we show the uncondi- 
tional security of the B92 protocol. The proof follows the 
idea in 9]- This paper is organized as follows. In Sec.lTTi 
we propose the protocol based on EDP with local filter- 
ing and CSS codes 0, and we reduce this to the B92 
protocol. In Sec. lIIII we give the formula for the error es- 
timations for EDP based on CSS code. Finally, in Sec. II VI 
we give the examples of the resulting performance, and 
the summary and discussion follow. 



II. PROTOCOL BASED ON EDP AND ITS 
REDUCTION TO THE B92 PROTOCOL 

In this section, we introduce the protocol that will turn 
out to be secure and will reduce to the B92 protocol. In 
this protocol, Alice first prepares a two-qubit nonmaxi- 
mally entangled states that can be written as 
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(|0.)a|vo>b + |1^>a|</?i)b) 



(1) 



a < l/^/2, [3 = 
)} is a basis (X-basis) of the qubit. 



and sends system B to Bob. Here 

(j = 0,1), where < 
yr^^,and{|0,),|l, 
AT-basis and Z-basis is related through the relationship 
as = [|0,) + (-l)J"|l,)]/V2. 

After receiving the state. Bob first performs the QND 
measurements that can be described by the POVM (pos- 
itive operator valued measure) 



(2) 
(3) 
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where Ilg is the projector onto the single photon space 
and "v" means the detection of vacuum state or multi- 
photon states. Thanks to this QND measurements, even 
if Eve sends multi-photon states or vacuum state to Bob, 
Alice and Bob can work only on the qubit pairs, provided 
that the outcome is "s". We also assume that, after this 
measurement, if the outcome is "s". Bob performs the 
"local filtering operation" ^3 on qubit B, described by 



2 



the Kraus operator 

^fii= ^(a|0,)B(0,|+/3|l,)B(lx|) , (4) 

where 7 e (0,1]. Note that if the channel is loss- 
free and noiseless or Eve does nothing, this opera- 
tion yields the maximally entangled state (EPR state) 
(|0,)a|0,)b + |1.)a|1x)b)/V2 with probability lo?-!' 
due to the fact that the initial state is also written as 
|*)ab = /3|0,)a|0,)b + a|l,)A|lx)B. Thus, the filter- 
ing operation with 7 = 1 is optimum one in this case. 
When channel is lossy and noisy, or Eve is present, the 
filtered states may include bit errors, represented by 
the subspace spanned by {\^z) k\^z)y>,A^z) k\^z)^'\ ■, and 
a phase error, represented by the subspace spanned by 
{|0:,)A|l:r)B,|l:.)A|0:,)B}. In ordcr to distiU the EPR 
pairs, Alice and Bob run the EDP based on CSS code Q 
and after this EDP Alice and Bob measure each in the 
Z-basis of the EPR pairs so that they obtain a secure key. 
Note that the QND measurement followed by the filter- 
ing Afii and Z-basis measurement is equivalent to a mea- 
surement A^Bg2 described by = 7^|^)(^|/(2/3^), 
= 7'|W)(Wl/(2/3^), F2^,, = n, - - F^, and 
F^ = t-F^-F^'-F^^^,, where |^) = a|0,)-(-lp73|l,). 

Thus A^B92 is ^^'^ same measurement as in the B92 with 
perfect photon detector, and A^b92 corresponds to the 
generalized B92 protocol. For convenience, let M'^g2 
the measurements described by the set of the POVM ele- 
ments {Fq , F^ , F^^^}. The following is the protocol that 
we want to be shown secure and reduce to the generalized 
B92 protocol. 

Protocol: (1) Alice prepares the state |\E')ab, and she 
sends the system B to Bob over a quantum channel. 
(2) Bob performs the QND measurement described by 
{Qsi Qv}i and he publicly announces the outcome. They 
take notes of the outcome. (3) Alice and Bob repeats the 
step (1) and (2) 2N times. Let 2LN be the number of 
outcomes that resulted in "v" . (4) Alice and Bob discard 
all the pairs whose outcomes of the QND measurement 
are "v" . By public discussion, Alice and Bob randomly 
permute the positions of the remaining 2(1 — L)N pairs. 
(5) For the first {1~ L)N pairs (check pairs), Alice mea- 
sures system A in the Z-basis, and Bob performs mea- 
surement A^B92 system. By public discussion, 
they determine the number Ucrr of errors in which Al- 
ice found and Bob's outcome was 1, or Alice found 1 
with Bob's outcome 0. (6) For the second (1 — L)N pairs 
(data pairs). Bob performs the filtering Am on each of 
his qubits, and announces the total number Ufn and the 
positions of the qubits that have passed the filtering. (7) 
From L, riorr and nei, they estimate an upper bound for 
the number of bit errors ribit, and an upper bound for 
the number of phase errors riph, in the Ufn pairs. If these 
bounds are too large, they abort the protocol. (8) They 
run an EDP that can produce ny^cy nearly perfect EPR 
pairs if the estimation is correct. (9) Alice and Bob each 
measures the EPR pairs in Z-basis to obtain a shared 
secret key. 



In the following, we will reduce our protocol to the B92 
protocol. Before this reduction, we should briefly men- 
tion what Alice and Bob do experimentally in the B92 
protocol. In the B92 protocol, Alice randomly prepares 
the single photon polarization in the state \ipo) or \ipi) 
and sends the state to Bob. After receiving the state. Bob 
performs measurement described by A^b92- When 7 = /? 
and Bob detects a single photon state, this measure- 
ment effectively performs a polarization measurement on 
the single photon state in a basis randomly chosen from 
{|(^o),|^o)} and {|(y9i), |^^)}. In the case where 7 = 1 
and Bob detects a single photon state, this measure- 
ment effectively performs a general measurement which 
describes the optimum unambiguous state discrimination 
between \ipq) and \(pi) pTl |. 

Thanks to Bob's perfect detector, if the outcome of 
the QND measurement is "s" , then Bob's states are pro- 
jected onto the single photon space. This projection re- 
quires two more steps in our protocol compared to the 
Protocol i in j^. The benefit of this projection is that 
for the states projected onto qubit-pairs Alice and Bob 
can use the one-way EDP based on CSS code j^] . In the 
context of QKD, this EDP allows Alice to perform Z- 
basis measurements immediately after she has prepared 
the state |v1/)ab and Bob to perform Z-basis measure- 
ments immediately after he has performed the filtering. 
Now Bob's measurement is described by A^b92- Since 
Bob performs the QND measurement before the mea- 
surement A^B92i measurement is equivalent to the 
measurement A^b92- ^ whole, the protocol has been 
reduced into the protocol where Alice prepares and sends 
\(po) or \(pi) randomly and Bob performs the A^boI mea- 
surement. This completes the reduction of our protocol 
into the generalized B92 protocol over lossy and noisy 
quantum channel. 

Due to this equivalence, it is sufficient to prove the 
security of the protocol for the security analysis of the 
B92. The most important part in the quantitative secu- 
rity analysis of our protocol is to estimate phase errors 
and bit errors in the step (7). If this estimation is not ex- 
ponentially reliable, then in the protocol Alice and Bob 
cannot distill the state sufficientlyclose to EPR state so 
that the protocol is not secure In the next section, 

we will give the formula to estimate the bit errors and 
phase errors. 



III. PHASE ERROR ESTIMATION FROM THE 
BIT ERROR 

In this section, we consider the error estimations in 
the step (7) of the protocol. Thanks to Bob's perfect 
detector, the filtered states are qubit states, which allows 
us to directly apply some inequalities from |9[. 

First, note that bit errors ribit in the data pairs could 
be determined if Alice measures those pairs in Z-basis, 
Bob performs measurement A^b92 onto those pairs, and 
they compare their results. Thus, the bit error rate rierr 
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in the check pairs and bit errors ribit in the data pairs 
are determined by the same measurements. Furthermore 
thanks to the random permutation in step (4), we can 
apply the classical probability estimation so that we ob- 
tain 



Pbit 



< {l-L)Nei. 



(5) 



For any strategy by Eve, the probability of violating this 
inequality is asymptotically less than exp [—(1 — L)Nel'\ . 

Since the POVM elements that give the bit error rate 
on the filtered states libit and phase error rate on the fil- 
tered states Ilph do not commute J2i , the classical proba- 
bility argument cannot be applied to the estimation of the 
phase errors from the bit errors. For the estimation, let 
us perform the gedanken measurements in the |ja;)Abx)B 
basis (i = 0, 1, j' — 0, 1, v), and let the numbers riy' of 
the pairs found in the state \ix)A\j'x)B- Here we define 
TiiY as the outcome where Alice obtains the bit value i 
and Bob obtains vacuum or multi-photon states. As far 
as we consider the measurement outcomes of the POVM 
elements that are diagonal with respect to \ix)A\jx)B ba- 
sis, we are allowed to apply the classical argument for the 
estimation. Thus, we have the following inequalities. 



a^("-oo + "-lo) + /3^(»^oi + '^ii) 
a^nio -I- /3^noi - 



r 



< (1 - L)iVe2(6) 

< (1 - L)A^e3,(7) 



which are violated with probability asymptotically less 
than exp [-2(1 - L)Nel] and exp [-2(1 - L)iVe|] , re- 
spectively. Similarly, since neither the noisy channel nor 
Eve can touch the qubits held by Alice, we have 



\a^N - (mo + nil + niv)| < Nei , 



(8) 



with probability of violation asymptotically less than 
exp(-2iVe|). 

In order to represent the bit error in the check pairs in 
terms of gedanken measurements, we introduce the global 
gedanken measurements in the basis (« = 0, 1, j — 
0, 1) and the number of the corresponding measure- 
ment outcomes to^, where \Tij) = {—ly^ l3\ix)A\jx)B + 
(_l)iO"+i)Q,|(j + l)^)A|(j + 1)x)b- Here the summation 
is taken modulo 2. Since the POVM element for the bit 
error is diagonal with respect to the \Tij) basis 
have 



(3^ 

{mil + moi)/2 -n. 

T 



< (1 - L)Ne5, 



(9) 



which is violated with probability asymptotically less 
than exp(-2(l - L)Nel). 

Since {IFqi), jFio)} and {|0j;)a|1x)b, \^x)a\^x)b} span 
the same subspace, we can relate mio + ^n-oi and ni^+n^n 
by the classical probability estimate as 



(mio -I- moi) - (nio + noi)| < (1 - L)NeQ, 



(10) 



which is violated with probability asymptotically less 
than exp [— i(l — L)Ne'^ . For the estimate of the phase 
error rate in the data qubit from the bit error rate in 
the check qubit, we need to relate TOoi/(moi + mio) 
to noi/ijiQi + nio). This relation cannot be obtained 
by classical arguments, since jFoi) and |02;)a|12;)b are 
nonorthogonal. In 0, the authors consider the qubits 
that are invariant under the random permutation in the 
limit of large number. Then they showed that when we 
consider the measurement outcomes onto such qubits, we 
are allowed to regard the qubits as if they arose from 
the independently and identically distributed quantum 
source. Their argument can be directly applied to our 
case, since in step (4) of the protocol we have also ap- 
plied the random permutation. Thus, we can make use 
of the exponentially reliable inequality derived in 9] as 



sm («; 



er <sm^ (1)1 <sin^{di+d)+es (11) 



for ^ = 0, 1, where all the angles are defined in [0, 7r/2] by 
the relations nii/(nii -|-noo) = sin^ 9q, noi/("'Oi +'^io) — 
sin^^i, TOii/(mii + moo) = sin^ 0o, moi/(moi -I- mio) = 
sin^ 01, and = sin^ 9. 

The Eqs. (|Sll- (|ll|l . together with the relation ^ riy/ = 
N and 'Y^rriij = (1 — L)N can be used to derive the 
formula for the estimation of the phase error from bit 
error. In the following we set ^ 0, (i = 1, 2, . . . 8) by 
taking the limit TV — > oo so that Eqs. (|5|l- (|10|l are now 
linear equations. 

We first consider the special case for the B92 where bit 
error rate in the filtered qubits is zero while the phase 
error rate in the qubits is not zero. Eve can accomplish 
this by using channel loss. From rtbit = 0, i.e., rtin — 
TOoi = 0, one can easily find that for nui/N = 2a^7^(l — 
L) 



Max 



»ph 



(12) 



> 1/2 



for L > - 



The limiting loss rate — coincides with the case 
where Eve employs optimum unambiguous state discrim- 
ination measurement [Tlj . In this attack, if she obtains 
the conclusive outcome, then she sends the corresponding 
state to Bob, otherwise she does not. 

Next we consider the general case. The relationship 
can be obtained by solving the equations that we have 
mentioned just above. After straight forward calcula- 
tions, we find the implicit constraint 



^2 



where 



/(x) ^ ^/(a;-Li)^-(-A + -^ 



a2 - /32 ^ 
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A ^ [(/3V7')WA^-2«^/3^]/(/3^-a2) 
X = 2nph/iV a')A 

Lo = a^niv/iV + /3^nov/iV 



(13) 



Here, x — Li and I — x — Lq are equal to (riio + ?^oi)/-^ £ind 
(noo + respectively so that they must be positive. 

Combining these positivity constraints with the positivi- 
ties inside the square roots, we have Li + 1 — A+ .,^^^0 1 < 



X < 1 



Lo 



A 



Lo 



We can eas- 



ily confirm that these equations are the same as equa- 
tions in where 7 = /? and the channel has no loss i.e., 
Lq = Li = 0. Eq. gives us the possible parameter 
set {nerr,n.ph} for fixed a, 7, Lq, Li, L, and nm. By tak- 
ing the optimum ratio between Lq and Li with respect to 
Uph for given n^rn i^m and L, we obtain an upper bound 
nph on the number of phase errors riph, as a function 
of the observed values ricrr, and L, and the chosen 
parameters a and 7. 



IV. EXAMPLES AND CONCLUSION 

In this section, at first we give the examples of the 
phase error estimation and resulting performance of the 
B92 protocol. 

To illustrate the accuracy of the phase error esti- 
mation and security performance of the B92 proto- 
col, we assign values to the observable data as they 
would arise from a depolarizing quantum channel with 
loss, i.e., the state p evolves into L|1/)(V"| + (1 — 



L) 



, where \V) is the vacuum 



state, L is the loss rate of quantum channel, p is the de- 
polarizing rate, and ct^ is the Pauli matrix. In Fig. ^ 
we show the upper bound of the estimated phase error 
rate, the actual phase error rate, and bit error rate for 
the case (a) p = 0.01, L = 0, and (b) p = 0.01, L = 0.5. 
These figures are independent of 7, since we plot the 
phase error rates normalized by nai so that the pre-factor 
/3^/7^ is cancelled. In each figure, it is seen that when 
|((/Jo|'/'i)P becomes smaller, the estimation of the phase 
errors becomes poorer. On the other hand, larger values 
of Kv'ol'/'i)^ make the signal more vulnerable to noise 
and loss. Furthermore, due to the loss, the estimation in 
(b) is poorer than that in (a), especially in the region for 
smah |((po|vi)P- 

Since Alice and Bob apply random permutation in the 
protocol, the achievable length of the final key is given 
byrikcy = (7^//3^)?T-fii[l-/i(nbit/?T-fii)-/i(nph/"-fii)] SEll 
, when fiph/nm < 1/2. Here h{p) = —p\og2P — (1 — 
p) log2 (1 — p)- The positivity of rikoy means that Alice 
and Bob generate a secure key. In Fig.|21(a), we have nu- 
merically calculated the key generation rate G = Ukcy/N 
in the case of 7 = /3 for the fixed value of |((pol</'i)P: L 
and p, and plot G optimized over [((/Solv'i)!^ as a func- 
tion of p. The optimum value of |(iy9o|</'i)P is shown in 
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FIG. 1: The estimated phase error rate nph/nm (dot-dashed 
line), the actual phase error rate (solid line), and bit error rate 
(dotted line) in case of p = 0.01. Diagram (a) is for L = 
and (b) is for L — 0.5. We assume that quantum channel is a 
depolarizing channel with loss. 



Fig. 121 (b). Since the optimization of the ratio between 
Lq and Li is complicated, we have optimized the ratio 
numerically. From Fig.|21(a), it is seen that the B92 pro- 
tocol as described here is secure up to p ^ 0.034 (in the 
case of L = 0), p ~ 0.023 (in the case of L = 0.2), and 
p ^ 0.012 (in the case of L = 0.5). The use of the gen- 
eral B92 measurement, i.e., 7=1 yields the higher secret 
key gain, however this does not change the cutoff of the 
gain nor the optimum angle in Fig. |21 (b) . This is again 
because of the fact that the cutoff is determined by the 
error rate normalized by rtfij. 

In the BB84 protocol or 6-state protocol fTl|, thanks 
to the randomly chosen conjugate bases, phase error es- 
timation is more precise than that in the B92 protocol. 
The poor estimation in the B92 makes this protocol more 
vulnerable to eavesdropping. Actually, it is known that 
the BB84 protocol and 6-state protocol are secure up to 
p ~ 0.165 and p ^ 0.1905 |0| corresponding to bit 
error rates of 11% and 12.7%, respectively. 

In summary, we have shown that the security proof of 
the B92 over loss-free channel can be adapted to lossy 
and noisy channels assuming Bob's detector that discrim- 
inates between single photon states on one hand and vac- 
uum state or multi-photon states on the other hand. We 
have derived the general formula for the estimation of the 
phase errors from bit errors. We have also shown that 
the boundary loss rate at which Eve can induce phase er- 
rors freely without inducing bit errors coincides with the 
case where Eve employs the optimum unambiguous state 
discrimination measurement. Finally, we have shown the 
examples of the security assuming the quantum channel 
is the depolarizing quantum channel with loss. 



5 



G 



0.5 
0.4 
0.3 
0.2 
0.1 



Y=P 



0.01 0.02 0.03 0.04 
(a) P 





0.7 


IN 






0.5 








0.3 




0.1 



0.01 0.02 0.03 0.04 

(b) ' 



FIG. 2: (a) The optimum key generation rate G for the case 
•y — P and (b) the optimum value of K^polvi)^- Here we 
assume that the quantum channel is the depolarizing chan- 
nel with loss. The dotted line, the dot-dashed, and solid line 
represent the case where L — 0, L = 0.2, and L — 0.5 respec- 
tively. 



It is an interesting problem to compare our results to 



the case where Eve performs only individual attack. For 
the B92 with loss, the security is estimated in How- 
ever in that paper, it is assumed that Alice and Bob em- 
ploy error discarding protocol so that we cannot compare 
our result to their result directly. We leave this problem 
for future studies. Another interesting problem is to con- 
sider the case where Bob's detector is not perfect. In this 
case, some filtered states may remain vacuum state or 
multi-photon states so that our proof cannot be directly 
applied. The security analysis of the B92 with coherent 
state is another interesting problem. Wc hope our study 
is helpful for solving these problems and we leave them 
as future studies. 
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